What is the fastest way to see why FortiGate is dropping traffic?

Run diagnose debug flow with a filter for the specific traffic (saddr, daddr, dport), start the trace, and enable output. It prints the exact policy ID that matched or the reason for the drop. Disable and reset debug when done. In the GUI, Policy Lookup gives a quicker static answer.

Is SSL VPN still supported on FortiGate?

No, not going forward. Starting in FortiOS 7.6.3, Fortinet removed SSL VPN tunnel mode and replaced it with IPsec VPN (which can run on TCP port 443). It is gone from the GUI and CLI, settings are not migrated automatically, and the new G-series models do not support SSL VPN at all. Migrate remote access to IPsec, or ZTNA for application access.

Which FortiOS version should I run in production in 2026?

The mature production branches are FortiOS 7.4 and 7.6 (7.6.6 is widely recommended). FortiOS 8.0 was announced but is not yet recommended for production. FortiOS 7.2 reaches end-of-support in September 2026, so plan an upgrade off 7.2.

Why does my IPsec tunnel come up but pass no traffic?

Phase 1 and Phase 2 negotiating successfully only builds the tunnel. You still need firewall policies in both directions with NAT disabled, a route to the remote subnet via the tunnel interface, and matching Phase 2 selectors. Check the Forward Traffic logs and verify the remote peer has a return route.

Fortinet

Configuration guides, model comparisons, and managed services for Fortinet's FortiGate platform.

All Case Studies Cloud & Productivity CRM & Business Applications Cybersecurity Fortinet IT Strategy & Insights Managed IT Services Press Releases

Fortinet

How To Troubleshoot Common FortiGate Configuration Issues

Most FortiGate configuration problems trace back to a short list of predictable culprits: a missing or wrong route,…

Maxim Kazachek

April 23, 2025 · 12 min read

Fortinet

What is FortiGate NGFW? Next-Generation Firewall Features

Network perimeters face a constant barrage of sophisticated threats, rendering older security methods increasingly ineffective. Simple packet filtering,…